Sante PACS Server CVE-2025-14501
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach PACS HTTP service over network
-
ExploitSend crafted Content-Length header
-
ExecutionTrigger NULL pointer dereference in parser
-
ImpactCrash service / deny imaging access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Sante PACS Server's HTTP service (the component that parses the Content-Length header); per AV:N/PR:N/UI:N this needs no authentication, no user interaction, and works against default installations exposing the HTTP listener. The practical limiting factor is network exposure: Sante PACS Server is typically deployed inside hospital/clinical networks rather than internet-facing, so reachability depends on whether the HTTP port is accessible to the attacker. Impact is confined to availability (service crash); there is no data exposure or code execution path indicated. |
| Impact | This is a moderate-priority availability issue rather than a top-tier emergency. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) indicates a network-reachable, low-complexity, unauthenticated flaw with impact strictly to availability - no confidentiality or integrity loss, consistent with a NULL pointer dereference (CWE-476) that crashes the service. The signals are internally consistent: the description's 'Authentication is not required' aligns with PR:N, and the HTTP Content-Length handling flaw aligns with AV:N. However, several key prioritization signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no indication of public POC, so exploitation likelihood cannot be quantified. Exploitation status is therefore 'no public exploit identified at time of analysis.' This was disclosed via Trend Micro ZDI (ZDI-25-1104 / ZDI-CAN-26770), which typically implies a coordinated disclosure with vendor patch rather than in-the-wild abuse. Net assessment: real but bounded risk - a reliable remote crash of a medical imaging server, which matters operationally in clinical environments, but with no evidence of active or automated exploitation and no data-compromise potential. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the Sante PACS Server's HTTP interface sends a crafted HTTP request with a malformed or inconsistent Content-Length header, causing the server to dereference an unvalidated pointer and crash. Repeated requests keep the PACS service offline, disrupting access to medical imaging. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Sante PACS Server can be forced into a denial-of-service condition by a remote, unauthenticated attacker who sends a crafted HTTP Content-Length header that triggers a NULL pointer dereference in the server's HTTP handling code. The high CVSS availability score reflects a service crash with no confidentiality or integrity impact, and the main exposure factor is whether the PACS HTTP listener is reachable from an untrusted network. No public exploit code or CISA KEV entry was identified in the provided data.
RemediationAI
No vendor-released fixed version is identified in the provided data; check ZDI-25-1104 (https://www.zerodayinitiative.com/advisories/ZDI-25-1104/) and the vendor for an updated build and apply it as soon as it is available. Until then, restrict network access to the PACS HTTP listener with firewall rules or clinical-network segmentation so only trusted subnets can reach it, accepting that this may require updates to workstation and integration workflows. If the HTTP interface is not operationally required, disable it or bind it to localhost/management-only interfaces, verifying that web-based clinical access and DICOM workflows still function. Deploy a reverse proxy or application-layer filter that rejects malformed or inconsistent Content-Length headers, and alert on repeated malformed HTTP requests or unexpected service restarts; these controls add latency and administrative overhead and should be validated against normal PACS traffic.
Affected ProductsAI
The affected product is Sante PACS Server, specifically the HTTP service component that processes Content-Length headers. No version range, build number, or CPE string is supplied in the available data, so administrators should use the ZDI advisory ZDI-25-1104 (https://www.zerodayinitiative.com/advisories/ZDI-25-1104/) to determine whether their installation is affected. No additional products are identified in the input.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-476 NULL pointer dereference in the Sante PACS Server HTTP service's parsing of the Content-Length header. HTTP Content-Length tells the server how many bytes to expect in a request body; if the implementation fails to validate a pointer before using it when handling this header, a malformed request can dereference NULL and crash the process, producing a denial of service. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms the attack is network-reachable, low-complexity, unauthenticated, and impacts availability only. The provided data does not include CPE identifiers or version ranges, so exact affected builds must be confirmed via ZDI-25-1104.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated HTTP request with no user interaction gives AV:N/AC:L/PR:N/UI:N; a NULL pointer dereference crashes only the service, so C:N/I:N/A:H.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of HTTP Content-Length header. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26770.
Executive ViewAI
Sante PACS Server is exposed to a high-severity denial-of-service condition that can take the imaging service offline, disrupting radiology and clinical workflows dependent on PACS availability. Leadership should treat this as an operational continuity risk for imaging-dependent care areas; no public exploit was identified at time of analysis, and no vendor-released patch was identified either.
No vendor-released patch identified; restrict HTTP listener access to trusted networks, deploy WAF/IPS signatures for malformed Content-Length headers, rate-limit and monitor PACS HTTP traffic, and apply the vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB